trustedsec / trustedsec/hate_crack
Determine whether hate_crack/main.py's __path__ shim is still needed, now that #276's guard mitigates its footgun
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.9k
- Forks
- 284
- Avg merge
- 21m
- Merged PRs (30d)
- 14
Description
Context
While fixing #276 (a mock.patch("hate_crack.main.llm.X", ...) string-target patch silently duplicates the llm module for the rest of the pytest session), the fix deliberately left the root cause in place: hate_crack/main.py sets __path__ = [_pkg_dir] so it looks like a package to the import system, which is what lets pkgutil.resolve_name import hate_crack.main.llm as a brand-new module instead of following the real attribute.
#276's fix added a session-wide conftest.py guard (_guard_submodule_identity) that detects and repairs this class of corruption, and converted the 57 known offending call sites — but it did not remove the shim itself, since doing so was out of scope and unverified.
Why the shim might be removable
A probe run during #276 (stripping the __path__ = [_pkg_dir] and __spec__.submodule_search_locations lines from a loaded copy of main.py) succeeded: from hate_crack import llm resolved fine, because a separate sys.path.insert(0, _root_dir) block just above it is what actually makes hate_crack.* imports resolve, and main.py uses no relative imports that would need __path__.
Why it wasn't removed
That probe ran with the package already importable from the repo root. The case the shim plausibly exists for is the installed/E2E load path, where main.py is loaded by path via importlib.util.spec_from_file_location rather than imported as part of the hate_crack package:
tests/test_e2e_local_install.py(opt-in,HATE_CRACK_RUN_E2E=1)tests/test_docker_script_install.py(opt-in,HATE_CRACK_RUN_DOCKER_TESTS=1)tests/test_help_before_build.pytests/conftest.py'sload_hate_crack_modulehelper
None of these were exercised during the probe, so whether the shim is load-bearing for that path is genuinely unverified rather than ruled out.
What's needed to close this
- Run the two opt-in E2E/Docker suites (
HATE_CRACK_RUN_E2E=1,HATE_CRACK_RUN_DOCKER_TESTS=1) with the__path__shim removed, to see if the by-path load still resolveshate_crack.*submodule imports correctly. - If it still works: remove the shim, which eliminates the #276 footgun at its root — the conftest guard then becomes a pure safety net rather than the only mitigation.
- If it breaks: document why the shim is load-bearing (which specific import chain needs
submodule_search_locations), so the next person doesn't re-probe from scratch.
Not urgent — the conftest guard fully mitigates the symptom already. This is a root-cause follow-up.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with hate_crack/main.py and the load_hate_crack_module helper in tests/conftest.py, then run tests/test_e2e_local_install.py with HATE_CRACK_RUN_E2E=1 and tests/test_docker_script_install.py with HATE_CRACK_RUN_DOCKER_TESTS=1 after removing the path shim in a test change. Check tests/test_help_before_build.py as well. Done means the by-path install and Docker flows still resolve hate_crack.* imports, or the specific load-bearing import chain is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing-qa, tooling
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100